Multi-Layer Defense Operations with Wazuh and FortiGate

Multi-Layer Defense Operations with Wazuh and FortiGate requires a clear data model so security teams can turn raw alerts into defensible actions. This article focuses on joining network and endpoint signals in one incident chain while clearly marking Windows Event style sources as roadmap when not active; instead of repeating generic product claims, it documents signals, a realistic example, and measurable operating guidance.

Technical Problem

In enterprise environments, one log source rarely tells the full story. Network, identity, device, and application records may look low-risk in isolation. When they are joined by time, user, and asset context, they become a security narrative that can be investigated and acted on.

Signals to Collect

• FortiGate traffic and VPN records
• Wazuh rule matches and agent events
• roadmap note for Windows Event correlation

These signals should use a shared schema. Otherwise the same value appears as source IP on one screen, client IP on another, and remote address in reports, creating contradictions for analysts and crawlers alike.

Realistic Scenario

If FortiGate shows an outbound connection and Wazuh shows suspicious process execution in the same minute, both belong in one incident; inactive Windows Event support must be labeled as roadmap.

Implementation Approach

Integration pages should separate active sources from planned features; crawlers and users need the same clarity.

Measurement and Validation

Success metric: measure the ratio of multi-source events merged into one incident.